CEH Web Application and Injection Attacks Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Enumerate all database names in non-interactive mode

  Why this is correct

  The `--dbs` option explicitly instructs sqlmap to enumerate and display the names of all accessible databases on the target system by querying the database's information schema or system tables. Concurrently, the `--batch` option ensures that sqlmap operates in a non-interactive mode, automatically accepting default choices and proceeding without requiring user input for any prompts or questions that might arise during the enumeration process. This combination efficiently retrieves database names without interruption, which is ideal for automated scripting.

• ✗

  Dump the entire contents of the current database

  Why it's wrong here

  This command does not facilitate dumping the entire contents of the current database. The `--dbs` option is solely for enumerating database names, not for extracting their data. To dump data, sqlmap requires specific options like `--dump` (for a specified table or database) or `--dump-all` (for all databases and tables), often combined with database (`-D`) and table (`-T`) parameters to precisely target the desired information for extraction.

• ✗

  Perform a time-based blind SQL injection to extract data

  Why it's wrong here

  While sqlmap is capable of performing various SQL injection techniques, including time-based blind, the provided command does not explicitly force this specific method. Sqlmap automatically attempts to identify the most effective injection technique for the target, which could be error-based, boolean-based, or union-based, among others, before resorting to time-based if necessary. The `--dbs` option merely defines the *target* of the enumeration (database names), not the *method* of injection to be used.

• ✗

  Enumerate all tables in all databases

  Why it's wrong here

  The `--dbs` option is designed exclusively to enumerate and display the names of databases found on the target system. It does not extend to enumerating tables within those databases, as it only retrieves the top-level database identifiers. To list tables, sqlmap requires the `--tables` option, which must be used in conjunction with the `-D <database_name>` option to specify which particular database's tables should be enumerated.

Go deeper

Related to this question